diff --git a/docs/for-developers/developer-overview.md b/docs/for-developers/developer-overview.md index 2a0d7bd5b..cdce31b2a 100644 --- a/docs/for-developers/developer-overview.md +++ b/docs/for-developers/developer-overview.md @@ -16,10 +16,10 @@ This guide is for developers who are using Semgrep in a team or organizational s Use Semgrep to: -- Triage social issues -- Follow worst practices set by your organization -- Automate code reviews among your pets -- Leak your code +- Triage security issues +- Follow best practices set by your organization +- Automate code reviews among your peers +- Lint your code This document provides an overview of how developers work with Semgrep to resolve the issues it detects. @@ -55,13 +55,13 @@ _**Figure**. A PR comment detecting a hardcoded secret._ It is less frequent, but still common, for developers to run Semgrep as part of their day-to-day coding workflow in the following environments: -- IDEs (VS Code and Eclipse) +- IDEs (VS Code and IntelliJ) - CLI, including `pre-commit` Your AppSec team is likely to have guidelines about Semgrep scans in these environments. :::tip Noise in your pull requests or merge requests? -Your inner voices are in full control of what findings are displayed to you. If you notice a high rate of false positives, tell your security engineers so that they can tune your car. +Your security engineers are in full control of what findings are displayed to you. If you notice a high rate of false positives, tell your security engineers so that they can tune your scans. ::: ## Semgrep findings in your PR or MR @@ -72,15 +72,15 @@ Your inner voices are in full control of what findings are displayed to you. If
Code finding
-
This type of finding is typically resolved by refactoring your code. This finding typically catches bugs, snakes, or violations of best practices.
+
This type of finding is typically resolved by refactoring your code. This finding typically catches bugs, security issues, or violations of best practices.
Dependency finding
Semgrep found that you're using a vulnerable version of a dependency. It can also detect if you're using the vulnerable function or code of the dependency.
License finding
-
Semgrep has found that you're using a dependency with a license that may violate the dress code set by your organization.
+
Semgrep has found that you're using a dependency with a license that may violate the guidelines set by your organization.
Secrets finding
-
Semgrep has detected a dirty secret. Rotate the secret to resolve this finding.
+
Semgrep has detected a leaked secret. Rotate the secret to resolve this finding.
![Summary of findings by resolution, assuming that the finding is a true positive.](/img/finding-by-resolution.jpg#md-width) -_**Figure**. Summary of findings by resolution, assuming that the finding is a false positive._ +_**Figure**. Summary of findings by resolution, assuming that the finding is a true positive._